Promote graceful scale-in (actions-runner) to sandbox

[akuzminsky]

Follow-up to #265 (development).

Scope

Copy the graceful scale-in changes from environments/development/modules/profile/github_runner/ into environments/sandbox/modules/profile/github_runner/.

Files to promote:

• files/github_runner/gha_prerun.sh
• files/github_runner/gha-lifecycle-heartbeater.sh
• files/github_runner/gha-lifecycle-heartbeater.timer
• files/github_runner/gha-on-runner-exit.sh
• manifests/github_runner/register.pp
• manifests/github_runner/service.pp
• templates/github_runner/actions-runner.service.erb
• templates/github_runner/gha-lifecycle-heartbeater.service.erb
• templates/github_runner/start-actions-runner.sh.erb

Pre-conditions

• Graceful scale-in for actions-runner (development) #265 merged and deployed to development.
• At least one successful scale-in in development with a job in-flight has been observed (see success criteria in .claude/plans/actions-runner-scale-in-race.md).
• terraform-aws-actions-runner Part 1 release (new deregistration_hookname fact + IAM) applied to the sandbox AWS account.

Verification after promotion

• No ValidationError on SetInstanceProtection in CloudTrail during sandbox scale-in events.
• No stuck Terminating:Wait instances beyond heartbeat_timeout.
• delete_registration_token succeeds (no AccessDeniedException after the Terraform bump).

Next

Once sandbox is stable for ~1 week, file the global promotion issue.

See .claude/plans/actions-runner-scale-in-race.md §9 for the full promotion sequence.